PT-2022-9491 · WordPress · Supportcandy

Apple502J · Published 2022-02-07 · Updated 2022-02-11 · CVE-2021-24880

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SupportCandy WordPress plugin versions prior to 2.2.7

Description The issue concerns the SupportCandy WordPress plugin, which does not validate and escape the page attribute of its shortcode. This could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

Recommendations For versions prior to 2.2.7, update to version 2.2.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the shortcode or limiting the roles that can use it until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24880

Affected Products

Supportcandy

References · 5

• 🔥 https://wpscan.com/vulnerability/09226067-0289-4d4f-9450-6f2c2ba058a0 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24880 · Security Note
• https://t.me/cvenotify/26609 · Telegram Post
• https://t.me/cibsecurity/36946 · Telegram Post